life-as-api 0.2.0

package/dist/proposal/in-memory-proposal-queue.js

@@ -0,0 +1,218 @@
+// InMemoryProposalQueue — Slice-08c hardened.
+//
+// PROPOSAL_QUEUE_EXISTS_001: sole mechanism for agent-authored claim proposals.
+// PROPOSAL_AGENT_CAN_CREATE_001: createProposal requires valid GrantRegistry entry.
+// PROPOSAL_CREATE_USES_GRANT_REGISTRY_001: grant validation uses GrantRegistry, not
+//   AgentConsentContext.capabilities (which is non-authoritative per
+//   PROPOSAL_CONTEXT_CAPABILITIES_NOT_AUTHORITATIVE_001).
+// PROPOSAL_AGENT_CANNOT_ACCEPT_001 + PROPOSAL_AGENT_CANNOT_REJECT_001: enforced here.
+// PROPOSAL_CANDIDATE_CLAIMS_NOT_LOGGED_BEFORE_ACCEPT_001: _appender never called in createProposal.
+// PROPOSAL_ACCEPT_NO_RAW_FACTSTORE_001: constructor takes AcceptedClaimAppender, not FactStore.
+// PROPOSAL_ACCEPT_ATOMIC_ROLLBACK_001: proposal status updated only AFTER appendAll() succeeds.
+// PROPOSAL_DENIED_CREATE_STORES_NOTHING_001: _proposals.set() only called after all checks pass.
+// PROPOSAL_ACCEPT_SOURCE_METADATA_REQUIRED_001: acceptance source must carry all 3 provenance fields.
+// PROPOSAL_ACCEPT_SOURCE_METADATA_MATCHES_PROPOSAL_001: metadata.acceptedFromProposalId === proposal.id.
+// PROPOSAL_ACCEPT_SOURCE_METADATA_MATCHES_AGENT_001: metadata.proposedBy === proposal.proposedBy.agentId.
+// PROPOSAL_ACCEPT_SOURCE_METADATA_MATCHES_GRANT_001: metadata.underGrant === proposal.underGrant.
+//
+// PROPOSAL_ACCEPT_ATOMICITY_MVP_LIMITATION_001 (InMemory):
+//   Source metadata validation + proposal status update bracket appendAll() synchronously.
+//   If appendAll() throws, _proposals retains "pending" (no partial acceptance).
+//   This is single-process best-effort atomicity — not a database transaction.
+//   SQLite ProposalQueue with transactional guarantees is deferred.
+import { asISOTime, asProposalId } from "../types/ids.js";
+function deepFreezeProposal(p) {
+    const frozen = {
+        ...p,
+        proposedBy: Object.freeze({ ...p.proposedBy }),
+        candidateClaims: Object.freeze([...p.candidateClaims]),
+        ...(p.decidedBy !== undefined ? { decidedBy: Object.freeze({ ...p.decidedBy }) } : {}),
+        ...(p.resultingClaimIds !== undefined ? { resultingClaimIds: Object.freeze([...p.resultingClaimIds]) } : {}),
+    };
+    return Object.freeze(frozen);
+}
+function isDecider(ctx) {
+    return ctx.kind === "owner" || ctx.kind === "system_projection" || ctx.kind === "test";
+}
+export class InMemoryProposalQueue {
+    _appender;
+    _grantRegistry;
+    _sourceRegistry;
+    _proposals = new Map();
+    // PROPOSAL_ACCEPT_NO_RAW_FACTSTORE_001: AcceptedClaimAppender (not raw FactStore).
+    // PROPOSAL_CREATE_USES_GRANT_REGISTRY_001: GrantRegistry is the auth source for createProposal.
+    // PROPOSAL_ACCEPT_SOURCE_METADATA_REQUIRED_001: SourceRegistry is needed to resolve acceptance
+    //   source and validate its provenance metadata before any writes.
+    constructor(_appender, _grantRegistry, _sourceRegistry) {
+        this._appender = _appender;
+        this._grantRegistry = _grantRegistry;
+        this._sourceRegistry = _sourceRegistry;
+    }
+    // ── createProposal ──────────────────────────────────────────────────────────
+    // PROPOSAL_QUEUE_ASYNC_INTEGRATION_DECIDED_001: async to satisfy updated ProposalQueue interface.
+    // No I/O here — the async wrapper has no behavioral effect on InMemoryProposalQueue.
+    async createProposal(ctx, input) {
+        // PROPOSAL_CREATE_USES_GRANT_REGISTRY_001: resolve grant from registry — ctx is untrusted.
+        const grant = this._grantRegistry.lookup(ctx.grantId);
+        if (grant === undefined) {
+            throw new Error("PROPOSAL_ACCEPT_REQUIRES_VALID_GRANT_001: grant not found in registry — " +
+                `grantId "${ctx.grantId}" has not been registered`);
+        }
+        if (grant.grantedTo.agentId !== ctx.agentId) {
+            throw new Error("PROPOSAL_ACCEPT_REQUIRES_VALID_GRANT_001: grant belongs to a different agent — " +
+                `grant.grantedTo.agentId="${grant.grantedTo.agentId}", ctx.agentId="${ctx.agentId}"`);
+        }
+        if (grant.purpose !== ctx.purpose) {
+            throw new Error(`PROPOSAL_ACCEPT_REQUIRES_VALID_GRANT_001: purpose mismatch — ` +
+                `grant.purpose="${grant.purpose}", ctx.purpose="${ctx.purpose}"`);
+        }
+        if (!grant.capabilities.includes("propose")) {
+            throw new Error("PROPOSAL_ACCEPT_REQUIRES_VALID_GRANT_001: grant lacks 'propose' capability — " +
+                `capabilities=${JSON.stringify(grant.capabilities)}`);
+        }
+        const now = Date.now();
+        if (new Date(grant.notAfter).getTime() <= now) {
+            throw new Error(`PROPOSAL_ACCEPT_REQUIRES_VALID_GRANT_001: grant is expired (notAfter="${grant.notAfter}")`);
+        }
+        if (new Date(grant.notBefore).getTime() > now) {
+            throw new Error(`PROPOSAL_ACCEPT_REQUIRES_VALID_GRANT_001: grant is not yet active (notBefore="${grant.notBefore}")`);
+        }
+        if (grant.revokedAt !== undefined) {
+            throw new Error(`PROPOSAL_ACCEPT_REQUIRES_VALID_GRANT_001: grant has been revoked (revokedAt="${grant.revokedAt}")`);
+        }
+        if (input.candidateClaims.length === 0) {
+            throw new Error("PROPOSAL_QUEUE_EXISTS_001: candidateClaims must not be empty");
+        }
+        // PROPOSAL_DENIED_CREATE_STORES_NOTHING_001: only reach _proposals.set after all checks pass.
+        const id = asProposalId(`prop_${globalThis.crypto.randomUUID()}`);
+        const proposal = deepFreezeProposal({
+            id,
+            proposedBy: { agentId: ctx.agentId, grantId: ctx.grantId, purpose: ctx.purpose },
+            underGrant: ctx.grantId,
+            candidateClaims: [...input.candidateClaims],
+            ...(input.rationale !== undefined ? { rationale: input.rationale } : {}),
+            status: "pending",
+            createdAt: asISOTime(new Date().toISOString()),
+        });
+        this._proposals.set(id, proposal);
+        return proposal;
+    }
+    // ── getProposal ─────────────────────────────────────────────────────────────
+    getProposal(ctx, proposalId) {
+        if (ctx == null)
+            throw new TypeError("AccessContext is required");
+        return this._proposals.get(proposalId);
+    }
+    // ── listProposals ───────────────────────────────────────────────────────────
+    listProposals(ctx, filter) {
+        if (ctx == null)
+            throw new TypeError("AccessContext is required");
+        let proposals = Array.from(this._proposals.values());
+        if (filter?.status !== undefined)
+            proposals = proposals.filter((p) => p.status === filter.status);
+        if (filter?.proposedByAgent !== undefined)
+            proposals = proposals.filter((p) => p.proposedBy.agentId === filter.proposedByAgent);
+        if (filter?.underGrant !== undefined)
+            proposals = proposals.filter((p) => p.underGrant === filter.underGrant);
+        return proposals;
+    }
+    // ── acceptProposal ──────────────────────────────────────────────────────────
+    async acceptProposal(ctx, proposalId, options) {
+        // PROPOSAL_AGENT_CANNOT_ACCEPT_001
+        if (!isDecider(ctx)) {
+            throw new Error("PROPOSAL_AGENT_CANNOT_ACCEPT_001: AgentConsentContext and AuditContext cannot accept proposals");
+        }
+        const proposal = this._getExistingPending(proposalId, "accept");
+        // PROPOSAL_ACCEPT_SOURCE_METADATA_REQUIRED_001 / MATCHES_*: resolve source and validate
+        // provenance metadata before any writes. These checks are part of the atomic pre-validation
+        // phase (PROPOSAL_ACCEPT_ATOMICITY_MVP_LIMITATION_001) — failure here leaves proposal "pending".
+        const source = this._sourceRegistry.getSource(ctx, options.sourceId);
+        if (source === undefined) {
+            throw new Error(`SOURCE_UNKNOWN_REJECTED_001: sourceId "${options.sourceId}" is not registered`);
+        }
+        if (source.status !== "active") {
+            throw new Error(`SOURCE_INACTIVE_REJECTED_001: sourceId "${options.sourceId}" is inactive`);
+        }
+        const meta = source.metadata;
+        if (meta === undefined || !("acceptedFromProposalId" in meta)) {
+            throw new Error(`PROPOSAL_ACCEPT_SOURCE_METADATA_REQUIRED_001: acceptance source "${options.sourceId}" must have metadata.acceptedFromProposalId`);
+        }
+        if (meta["acceptedFromProposalId"] !== proposal.id) {
+            throw new Error(`PROPOSAL_ACCEPT_SOURCE_METADATA_MATCHES_PROPOSAL_001: metadata.acceptedFromProposalId "${String(meta["acceptedFromProposalId"])}" does not match proposal.id "${proposal.id}"`);
+        }
+        if (!("proposedBy" in meta)) {
+            throw new Error(`PROPOSAL_ACCEPT_SOURCE_METADATA_REQUIRED_001: acceptance source "${options.sourceId}" must have metadata.proposedBy`);
+        }
+        if (meta["proposedBy"] !== proposal.proposedBy.agentId) {
+            throw new Error(`PROPOSAL_ACCEPT_SOURCE_METADATA_MATCHES_AGENT_001: metadata.proposedBy "${String(meta["proposedBy"])}" does not match proposal.proposedBy.agentId "${proposal.proposedBy.agentId}"`);
+        }
+        if (!("underGrant" in meta)) {
+            throw new Error(`PROPOSAL_ACCEPT_SOURCE_METADATA_REQUIRED_001: acceptance source "${options.sourceId}" must have metadata.underGrant`);
+        }
+        if (meta["underGrant"] !== proposal.underGrant) {
+            throw new Error(`PROPOSAL_ACCEPT_SOURCE_METADATA_MATCHES_GRANT_001: metadata.underGrant "${String(meta["underGrant"])}" does not match proposal.underGrant "${proposal.underGrant}"`);
+        }
+        // Override sourceId for every candidate claim before appending.
+        // candidateClaims may carry agent_proposal sourceId — acceptance source replaces it.
+        const finalClaims = proposal.candidateClaims.map((c) => ({ ...c, sourceId: options.sourceId }));
+        // PROPOSAL_ACCEPT_ATOMIC_ROLLBACK_001: appendAll is the atomic write gate.
+        // If this throws, no claims are written and proposal remains "pending" (not mutated below).
+        // PROPOSAL_ACCEPT_USES_SOURCE_AWARE_FACTSTORE_001: enforced by AcceptedClaimAppender contract.
+        const claimIds = await this._appender.appendAll(ctx, finalClaims);
+        // Update status only AFTER successful appendAll.
+        const accepted = deepFreezeProposal({
+            ...this._spreadProposal(proposal),
+            status: "accepted",
+            decidedAt: asISOTime(new Date().toISOString()),
+            decidedBy: ctx,
+            resultingClaimIds: claimIds,
+        });
+        this._proposals.set(proposalId, accepted);
+        return accepted;
+    }
+    // ── rejectProposal ──────────────────────────────────────────────────────────
+    // PROPOSAL_QUEUE_ASYNC_INTEGRATION_DECIDED_001: async to satisfy updated ProposalQueue interface.
+    async rejectProposal(ctx, proposalId, reason) {
+        // PROPOSAL_AGENT_CANNOT_REJECT_001
+        if (!isDecider(ctx)) {
+            throw new Error("PROPOSAL_AGENT_CANNOT_REJECT_001: AgentConsentContext and AuditContext cannot reject proposals");
+        }
+        const proposal = this._getExistingPending(proposalId, "reject");
+        const rejected = deepFreezeProposal({
+            ...this._spreadProposal(proposal),
+            status: "rejected",
+            decidedAt: asISOTime(new Date().toISOString()),
+            decidedBy: ctx,
+            rejectionReason: reason,
+        });
+        this._proposals.set(proposalId, rejected);
+        return rejected;
+    }
+    // ── Private helpers ─────────────────────────────────────────────────────────
+    _getExistingPending(proposalId, action) {
+        const proposal = this._proposals.get(proposalId);
+        if (proposal === undefined) {
+            throw new Error(`PROPOSAL_QUEUE_EXISTS_001: proposal "${proposalId}" not found`);
+        }
+        if (proposal.status !== "pending") {
+            throw new Error(`PROPOSAL_STATUS_IMMUTABLE_AFTER_DECISION_001: proposal "${proposalId}" is ` +
+                `"${proposal.status}" and cannot be ${action}ed again`);
+        }
+        return proposal;
+    }
+    // Spread a Proposal to a mutable base, excluding optional decision fields.
+    // Needed because Object.freeze + spread can include absent optional keys as undefined,
+    // which would violate exactOptionalPropertyTypes.
+    _spreadProposal(p) {
+        return {
+            id: p.id,
+            proposedBy: p.proposedBy,
+            underGrant: p.underGrant,
+            candidateClaims: p.candidateClaims,
+            status: p.status,
+            createdAt: p.createdAt,
+            ...(p.rationale !== undefined ? { rationale: p.rationale } : {}),
+        };
+    }
+}
+//# sourceMappingURL=in-memory-proposal-queue.js.map

package/dist/proposal/in-memory-proposal-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-proposal-queue.js","sourceRoot":"","sources":["../../src/proposal/in-memory-proposal-queue.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,gFAAgF;AAChF,oFAAoF;AACpF,oFAAoF;AACpF,qEAAqE;AACrE,0DAA0D;AAC1D,sFAAsF;AACtF,oGAAoG;AACpG,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,sGAAsG;AACtG,yGAAyG;AACzG,0GAA0G;AAC1G,kGAAkG;AAClG,EAAE;AACF,2DAA2D;AAC3D,2FAA2F;AAC3F,iFAAiF;AACjF,+EAA+E;AAC/E,oEAAoE;AAUpE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE1D,SAAS,kBAAkB,CAAC,CAAW;IACrC,MAAM,MAAM,GAAG;QACb,GAAG,CAAC;QACJ,UAAU,EAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;QACnD,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC;QACtD,GAAG,CAAC,CAAC,CAAC,SAAS,KAAa,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAU,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,EAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,GAAG,CAAC,CAAC,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7G,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAa,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,GAAkB;IACnC,OAAO,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC;AACzF,CAAC;AAED,MAAM,OAAO,qBAAqB;IAQb;IACA;IACA;IATF,UAAU,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE9D,mFAAmF;IACnF,gGAAgG;IAChG,+FAA+F;IAC/F,mEAAmE;IACnE,YACmB,SAAuC,EACvC,cAA+B,EAC/B,eAAgC;QAFhC,cAAS,GAAT,SAAS,CAA8B;QACvC,mBAAc,GAAd,cAAc,CAAiB;QAC/B,oBAAe,GAAf,eAAe,CAAiB;IAChD,CAAC;IAEJ,+EAA+E;IAC/E,kGAAkG;IAClG,qFAAqF;IAErF,KAAK,CAAC,cAAc,CAAC,GAAwB,EAAE,KAAoB;QACjE,2FAA2F;QAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,YAAY,GAAG,CAAC,OAAO,2BAA2B,CACrD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,iFAAiF;gBAC/E,4BAA4B,KAAK,CAAC,SAAS,CAAC,OAAO,mBAAmB,GAAG,CAAC,OAAO,GAAG,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,+DAA+D;gBAC7D,kBAAkB,KAAK,CAAC,OAAO,mBAAmB,GAAG,CAAC,OAAO,GAAG,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,+EAA+E;gBAC7E,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CACvD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,yEAAyE,KAAK,CAAC,QAAQ,IAAI,CAC5F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,iFAAiF,KAAK,CAAC,SAAS,IAAI,CACrG,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,gFAAgF,KAAK,CAAC,SAAS,IAAI,CACpG,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,8FAA8F;QAC9F,MAAM,EAAE,GAAG,YAAY,CAAC,QAAQ,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAa,kBAAkB,CAAC;YAC5C,EAAE;YACF,UAAU,EAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;YACrF,UAAU,EAAO,GAAG,CAAC,OAAO;YAC5B,eAAe,EAAE,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,EAAW,SAAS;YAC1B,SAAS,EAAQ,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SACrD,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,+EAA+E;IAE/E,WAAW,CAAC,GAAkB,EAAE,UAAsB;QACpD,IAAI,GAAG,IAAI,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED,+EAA+E;IAE/E,aAAa,CAAC,GAAkB,EAAE,MAAuB;QACvD,IAAI,GAAG,IAAI,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAClE,IAAI,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,IAAI,MAAM,EAAE,MAAM,KAAc,SAAS;YAAE,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAiB,MAAM,CAAC,MAAM,CAAC,CAAC;QACvH,IAAI,MAAM,EAAE,eAAe,KAAK,SAAS;YAAE,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,eAAe,CAAC,CAAC;QAChI,IAAI,MAAM,EAAE,UAAU,KAAU,SAAS;YAAE,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAa,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3H,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,+EAA+E;IAE/E,KAAK,CAAC,cAAc,CAClB,GAA2B,EAC3B,UAAsB,EACtB,OAAyB;QAEzB,mCAAmC;QACnC,IAAI,CAAC,SAAS,CAAC,GAAoB,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEhE,wFAAwF;QACxF,4FAA4F;QAC5F,iGAAiG;QACjG,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,QAAQ,qBAAqB,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,2CAA2C,OAAO,CAAC,QAAQ,eAAe,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,wBAAwB,IAAI,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACb,oEAAoE,OAAO,CAAC,QAAQ,6CAA6C,CAClI,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,wBAAwB,CAAC,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,0FAA0F,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,iCAAiC,QAAQ,CAAC,EAAE,GAAG,CAChL,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,oEAAoE,OAAO,CAAC,QAAQ,iCAAiC,CACtH,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,2EAA2E,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,iDAAiD,QAAQ,CAAC,UAAU,CAAC,OAAO,GAAG,CACrL,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,oEAAoE,OAAO,CAAC,QAAQ,iCAAiC,CACtH,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,2EAA2E,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,yCAAyC,QAAQ,CAAC,UAAU,GAAG,CACrK,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,qFAAqF;QACrF,MAAM,WAAW,GAAuB,QAAQ,CAAC,eAAe,CAAC,GAAG,CAClE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC9C,CAAC;QAEF,2EAA2E;QAC3E,4FAA4F;QAC5F,+FAA+F;QAC/F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAElE,iDAAiD;QACjD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;YACjC,MAAM,EAAa,UAAU;YAC7B,SAAS,EAAU,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACtD,SAAS,EAAU,GAAG;YACtB,iBAAiB,EAAE,QAAQ;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,+EAA+E;IAC/E,kGAAkG;IAElG,KAAK,CAAC,cAAc,CAAC,GAAoB,EAAE,UAAsB,EAAE,MAAc;QAC/E,mCAAmC;QACnC,IAAI,CAAC,SAAS,CAAC,GAAoB,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEhE,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;YACjC,MAAM,EAAW,UAAU;YAC3B,SAAS,EAAQ,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACpD,SAAS,EAAQ,GAAG;YACpB,eAAe,EAAE,MAAM;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,+EAA+E;IAEvE,mBAAmB,CAAC,UAAsB,EAAE,MAA2B;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,wCAAwC,UAAU,aAAa,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,2DAA2D,UAAU,OAAO;gBAC1E,IAAI,QAAQ,CAAC,MAAM,mBAAmB,MAAM,UAAU,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,2EAA2E;IAC3E,uFAAuF;IACvF,kDAAkD;IAC1C,eAAe,CAAC,CAAW;QACjC,OAAO;YACL,EAAE,EAAe,CAAC,CAAC,EAAE;YACrB,UAAU,EAAO,CAAC,CAAC,UAAU;YAC7B,UAAU,EAAO,CAAC,CAAC,UAAU;YAC7B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,MAAM,EAAW,CAAC,CAAC,MAAM;YACzB,SAAS,EAAQ,CAAC,CAAC,SAAS;YAC5B,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;IACJ,CAAC;CACF"}

package/dist/proposal/policy-aware-proposal-queue.d.ts

@@ -0,0 +1,23 @@
+import type { AgentConsentContext, AccessContext } from "../types/access-context.js";
+import type { AcceptOptions, Proposal, ProposalDecider, ProposalFilter, ProposalInput } from "../types/proposal.js";
+import type { ProposalId } from "../types/ids.js";
+import type { FactoryCompatibleProposalQueue } from "./proposal-queue.js";
+import type { ProposalPolicy } from "./proposal-policy.js";
+import type { SourceRegistry } from "../source/source-registry.js";
+import type { AuditLog } from "../audit/audit-log.js";
+export declare class PolicyAwareProposalQueue implements FactoryCompatibleProposalQueue {
+    private readonly _inner;
+    private readonly _policy;
+    private readonly _sourceRegistry;
+    private readonly _auditLog;
+    readonly factoryCompatible: "durable-proposal-queue";
+    constructor(_inner: FactoryCompatibleProposalQueue, _policy: ProposalPolicy, _sourceRegistry: SourceRegistry, _auditLog: AuditLog);
+    getProposal(ctx: AccessContext, proposalId: ProposalId): Proposal | undefined;
+    listProposals(ctx: AccessContext, filter?: ProposalFilter): Proposal[];
+    acceptProposal(ctx: ProposalDecider, proposalId: ProposalId, options: AcceptOptions): Promise<Proposal>;
+    rejectProposal(ctx: ProposalDecider, proposalId: ProposalId, reason: string): Promise<Proposal>;
+    createProposal(ctx: AgentConsentContext, input: ProposalInput): Promise<Proposal>;
+    private _evaluateCombined;
+    private _autoReject;
+    private _autoAccept;
+}

package/dist/proposal/policy-aware-proposal-queue.js

@@ -0,0 +1,162 @@
+// Platform-02 — PolicyAwareProposalQueue (factory-internal decorator).
+//
+// PROPOSAL_AUTO_ACCEPTED_BY_POLICY_001: auto-accepted proposals produce a durable audit
+//   event with reasonCode PROPOSAL_AUTO_ACCEPTED_BY_POLICY and the resulting claim ids.
+// PROPOSAL_AUTO_REJECTED_BY_POLICY_001: same for auto-reject, decision "deny".
+// PROPOSAL_POLICY_AUTO_ACCEPT_FAILURE_FALLS_BACK_TO_MANUAL_001: accept-path failure leaves
+//   the proposal pending; createProposal does not throw.
+// PROPOSAL_POLICY_EVALUATED_AFTER_CREATE_VALIDATION_001: policy runs only after the inner
+//   queue's grant/capability validation succeeded; an invalid grant still throws exactly
+//   as before.
+// PROPOSAL_POLICY_SCOPE_DERIVED_FROM_PREDICATE_001: scope string is "write:<predicate>";
+//   combination rule: any auto-reject → reject; all auto-accept → accept; else manual.
+// PROPOSAL_POLICY_ACCEPTANCE_SOURCE_PER_PROPOSAL_001: auto-accept registers a fresh
+//   document_upload source "policy-accept:<proposalId>" carrying the three provenance
+//   metadata fields.
+//
+// NOT exported from src/index.ts — factory-internal wiring only.
+import { buildAuditEvent } from "../audit/audit-log.js";
+import { asSourceId, asISOTime } from "../types/ids.js";
+// Module-private system decider: auto-decisions (auto-accept / auto-reject) are system
+// decisions made by the configured ProposalPolicy, not by a human owner. The inner queue
+// validates decider kind via ProposalDecider (owner | system_projection | test).
+const SYSTEM_DECIDER = { kind: "system_projection" };
+export class PolicyAwareProposalQueue {
+    _inner;
+    _policy;
+    _sourceRegistry;
+    _auditLog;
+    // Truthful marker: this decorator delegates all durable writes to the inner
+    // durable-proposal-queue; it adds no separate storage of its own.
+    factoryCompatible = "durable-proposal-queue";
+    constructor(_inner, _policy, _sourceRegistry, _auditLog) {
+        this._inner = _inner;
+        this._policy = _policy;
+        this._sourceRegistry = _sourceRegistry;
+        this._auditLog = _auditLog;
+    }
+    getProposal(ctx, proposalId) {
+        return this._inner.getProposal(ctx, proposalId);
+    }
+    listProposals(ctx, filter) {
+        return this._inner.listProposals(ctx, filter);
+    }
+    acceptProposal(ctx, proposalId, options) {
+        return this._inner.acceptProposal(ctx, proposalId, options);
+    }
+    rejectProposal(ctx, proposalId, reason) {
+        return this._inner.rejectProposal(ctx, proposalId, reason);
+    }
+    // PROPOSAL_POLICY_EVALUATED_AFTER_CREATE_VALIDATION_001: all existing grant/capability
+    // validation happens inside _inner.createProposal — if it throws, policy is never consulted.
+    async createProposal(ctx, input) {
+        const proposal = await this._inner.createProposal(ctx, input);
+        const disposition = await this._evaluateCombined(ctx, proposal);
+        if (disposition === "manual") {
+            // PROPOSAL_POLICY_OPTIONAL_NO_CHECK_WHEN_ABSENT_001 backward-compat is handled at
+            // factory level (queue not wrapped at all). Manual here means today's behavior.
+            return proposal;
+        }
+        if (disposition === "auto-reject") {
+            return this._autoReject(ctx, proposal);
+        }
+        // disposition === "auto-accept"
+        return this._autoAccept(ctx, proposal);
+    }
+    // PROPOSAL_POLICY_SCOPE_DERIVED_FROM_PREDICATE_001: evaluate per candidate claim and
+    // combine — any auto-reject wins; else all auto-accept required; else manual.
+    async _evaluateCombined(ctx, proposal) {
+        const dispositions = [];
+        for (const claim of proposal.candidateClaims) {
+            let disposition;
+            try {
+                disposition = await this._policy.evaluate({
+                    sourceId: ctx.agentId,
+                    scope: "write:" + claim.predicate,
+                    subjectId: claim.subject,
+                });
+            }
+            catch {
+                // PROPOSAL_POLICY_FAIL_SAFE_MANUAL_001: policy exception → treat as manual.
+                disposition = "manual";
+            }
+            dispositions.push(disposition);
+        }
+        if (dispositions.some((d) => d === "auto-reject"))
+            return "auto-reject";
+        if (dispositions.length > 0 && dispositions.every((d) => d === "auto-accept"))
+            return "auto-accept";
+        return "manual";
+    }
+    async _autoReject(ctx, proposal) {
+        const rejected = await this._inner.rejectProposal(SYSTEM_DECIDER, proposal.id, "PROPOSAL_AUTO_REJECTED_BY_POLICY_001: proposal auto-rejected by configured ProposalPolicy");
+        // Audit-write failure on this success path propagates — fail-closed,
+        // AUDIT_FAIL_CLOSED_001-consistent.
+        await this._auditLog.write(buildAuditEvent({
+            actor: ctx.agentId,
+            grantId: ctx.grantId,
+            purpose: ctx.purpose,
+            decision: "deny",
+            reasonCode: "PROPOSAL_AUTO_REJECTED_BY_POLICY",
+            selectorFingerprint: "proposal-policy:" + proposal.id,
+            resultCount: 0,
+            resultClaimIds: [],
+            now: asISOTime(new Date().toISOString()),
+        }));
+        return rejected;
+    }
+    async _autoAccept(ctx, proposal) {
+        try {
+            // PROPOSAL_POLICY_ACCEPTANCE_SOURCE_PER_PROPOSAL_001
+            const sourceId = asSourceId("policy-accept:" + proposal.id);
+            this._sourceRegistry.registerSource(SYSTEM_DECIDER, {
+                id: sourceId,
+                kind: "document_upload",
+                label: "Policy auto-accept from trusted source " + ctx.agentId,
+                metadata: {
+                    acceptedFromProposalId: proposal.id,
+                    proposedBy: proposal.proposedBy.agentId,
+                    underGrant: proposal.underGrant,
+                },
+            });
+            const accepted = await this._inner.acceptProposal(SYSTEM_DECIDER, proposal.id, { sourceId });
+            // Audit-write failure on this success path propagates — fail-closed,
+            // AUDIT_FAIL_CLOSED_001-consistent.
+            await this._auditLog.write(buildAuditEvent({
+                actor: ctx.agentId,
+                grantId: ctx.grantId,
+                purpose: ctx.purpose,
+                decision: "allow",
+                reasonCode: "PROPOSAL_AUTO_ACCEPTED_BY_POLICY",
+                selectorFingerprint: "proposal-policy:" + proposal.id,
+                resultCount: accepted.resultingClaimIds?.length ?? 0,
+                resultClaimIds: accepted.resultingClaimIds ?? [],
+                now: asISOTime(new Date().toISOString()),
+            }));
+            return accepted;
+        }
+        catch {
+            // PROPOSAL_POLICY_AUTO_ACCEPT_FAILURE_FALLS_BACK_TO_MANUAL_001: fallback to manual
+            // review — never fail the caller's createProposal. Audit failure in THIS catch path
+            // only is swallowed (best-effort).
+            try {
+                await this._auditLog.write(buildAuditEvent({
+                    actor: ctx.agentId,
+                    grantId: ctx.grantId,
+                    purpose: ctx.purpose,
+                    decision: "deny",
+                    reasonCode: "PROPOSAL_AUTO_ACCEPT_FAILED_MANUAL_FALLBACK",
+                    selectorFingerprint: "proposal-policy:" + proposal.id,
+                    resultCount: 0,
+                    resultClaimIds: [],
+                    now: asISOTime(new Date().toISOString()),
+                }));
+            }
+            catch {
+                // Best-effort — swallow audit failure in this catch path only.
+            }
+            return proposal;
+        }
+    }
+}
+//# sourceMappingURL=policy-aware-proposal-queue.js.map

package/dist/proposal/policy-aware-proposal-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-aware-proposal-queue.js","sourceRoot":"","sources":["../../src/proposal/policy-aware-proposal-queue.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,wFAAwF;AACxF,wFAAwF;AACxF,+EAA+E;AAC/E,2FAA2F;AAC3F,yDAAyD;AACzD,0FAA0F;AAC1F,yFAAyF;AACzF,eAAe;AACf,yFAAyF;AACzF,uFAAuF;AACvF,oFAAoF;AACpF,sFAAsF;AACtF,qBAAqB;AACrB,EAAE;AACF,iEAAiE;AASjE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAExD,uFAAuF;AACvF,yFAAyF;AACzF,iFAAiF;AACjF,MAAM,cAAc,GAA4B,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;AAE9E,MAAM,OAAO,wBAAwB;IAMhB;IACA;IACA;IACA;IARnB,4EAA4E;IAC5E,kEAAkE;IACzD,iBAAiB,GAAG,wBAAiC,CAAC;IAE/D,YACmB,MAAsC,EACtC,OAAuB,EACvB,eAA+B,EAC/B,SAAmB;QAHnB,WAAM,GAAN,MAAM,CAAgC;QACtC,YAAO,GAAP,OAAO,CAAgB;QACvB,oBAAe,GAAf,eAAe,CAAgB;QAC/B,cAAS,GAAT,SAAS,CAAU;IACnC,CAAC;IAEJ,WAAW,CAAC,GAAkB,EAAE,UAAsB;QACpD,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAED,aAAa,CAAC,GAAkB,EAAE,MAAuB;QACvD,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,cAAc,CAAC,GAAoB,EAAE,UAAsB,EAAE,OAAsB;QACjF,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,cAAc,CAAC,GAAoB,EAAE,UAAsB,EAAE,MAAc;QACzE,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,uFAAuF;IACvF,6FAA6F;IAC7F,KAAK,CAAC,cAAc,CAAC,GAAwB,EAAE,KAAoB;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAE9D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEhE,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC7B,kFAAkF;YAClF,gFAAgF;YAChF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;QAED,gCAAgC;QAChC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,qFAAqF;IACrF,8EAA8E;IACtE,KAAK,CAAC,iBAAiB,CAC7B,GAAwB,EACxB,QAAkB;QAElB,MAAM,YAAY,GAA0B,EAAE,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC7C,IAAI,WAAgC,CAAC;YACrC,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACxC,QAAQ,EAAG,GAAG,CAAC,OAAO;oBACtB,KAAK,EAAM,QAAQ,GAAG,KAAK,CAAC,SAAS;oBACrC,SAAS,EAAE,KAAK,CAAC,OAAO;iBACzB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,4EAA4E;gBAC5E,WAAW,GAAG,QAAQ,CAAC;YACzB,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC;YAAE,OAAO,aAAa,CAAC;QACxE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC;YAAE,OAAO,aAAa,CAAC;QACpG,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,GAAwB,EAAE,QAAkB;QACpE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAC/C,cAAc,EACd,QAAQ,CAAC,EAAE,EACX,2FAA2F,CAC5F,CAAC;QAEF,qEAAqE;QACrE,oCAAoC;QACpC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC;YACzC,KAAK,EAAgB,GAAG,CAAC,OAAO;YAChC,OAAO,EAAc,GAAG,CAAC,OAAO;YAChC,OAAO,EAAc,GAAG,CAAC,OAAO;YAChC,QAAQ,EAAa,MAAM;YAC3B,UAAU,EAAW,kCAAkC;YACvD,mBAAmB,EAAE,kBAAkB,GAAG,QAAQ,CAAC,EAAE;YACrD,WAAW,EAAU,CAAC;YACtB,cAAc,EAAO,EAAE;YACvB,GAAG,EAAkB,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SACzD,CAAC,CAAC,CAAC;QAEJ,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,GAAwB,EAAE,QAAkB;QACpE,IAAI,CAAC;YACH,qDAAqD;YACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,gBAAgB,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,cAAc,EAAE;gBAClD,EAAE,EAAK,QAAQ;gBACf,IAAI,EAAG,iBAAiB;gBACxB,KAAK,EAAE,yCAAyC,GAAG,GAAG,CAAC,OAAO;gBAC9D,QAAQ,EAAE;oBACR,sBAAsB,EAAE,QAAQ,CAAC,EAAE;oBACnC,UAAU,EAAc,QAAQ,CAAC,UAAU,CAAC,OAAO;oBACnD,UAAU,EAAc,QAAQ,CAAC,UAAU;iBAC5C;aACF,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAE7F,qEAAqE;YACrE,oCAAoC;YACpC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC;gBACzC,KAAK,EAAgB,GAAG,CAAC,OAAO;gBAChC,OAAO,EAAc,GAAG,CAAC,OAAO;gBAChC,OAAO,EAAc,GAAG,CAAC,OAAO;gBAChC,QAAQ,EAAa,OAAO;gBAC5B,UAAU,EAAW,kCAAkC;gBACvD,mBAAmB,EAAE,kBAAkB,GAAG,QAAQ,CAAC,EAAE;gBACrD,WAAW,EAAU,QAAQ,CAAC,iBAAiB,EAAE,MAAM,IAAI,CAAC;gBAC5D,cAAc,EAAO,QAAQ,CAAC,iBAAiB,IAAI,EAAE;gBACrD,GAAG,EAAkB,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aACzD,CAAC,CAAC,CAAC;YAEJ,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,mFAAmF;YACnF,oFAAoF;YACpF,mCAAmC;YACnC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC;oBACzC,KAAK,EAAgB,GAAG,CAAC,OAAO;oBAChC,OAAO,EAAc,GAAG,CAAC,OAAO;oBAChC,OAAO,EAAc,GAAG,CAAC,OAAO;oBAChC,QAAQ,EAAa,MAAM;oBAC3B,UAAU,EAAW,6CAA6C;oBAClE,mBAAmB,EAAE,kBAAkB,GAAG,QAAQ,CAAC,EAAE;oBACrD,WAAW,EAAU,CAAC;oBACtB,cAAc,EAAO,EAAE;oBACvB,GAAG,EAAkB,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;iBACzD,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;CACF"}

package/dist/proposal/proposal-policy.d.ts

@@ -0,0 +1,37 @@
+import type { TrustedDataSourceRegistry } from "../datasource/trusted-data-source-registry.js";
+export type ProposalDisposition = "auto-accept" | "manual" | "auto-reject";
+export interface ProposalPolicyInput {
+    /** Proposing institution — equals the proposing agent's agentId. */
+    readonly sourceId: string;
+    /** "write:<predicate>" derived from a candidate claim. */
+    readonly scope: string;
+    /** Candidate claim subject (PersonId as string). */
+    readonly subjectId: string;
+}
+export interface ProposalPolicy {
+    evaluate(input: ProposalPolicyInput): Promise<ProposalDisposition>;
+}
+/** Always "manual" — matches pre-Platform-02 behavior when no policy is configured. */
+export declare class DefaultProposalPolicy implements ProposalPolicy {
+    evaluate(_input: ProposalPolicyInput): Promise<ProposalDisposition>;
+}
+/**
+ * Evaluation order:
+ *   1. sourceId in reject-list → "auto-reject" (PROPOSAL_POLICY_REJECT_LIST_PRECEDENCE_001).
+ *   2. registry.isSourceTrusted(sourceId, scope) === true AND subjectId not deny-listed
+ *      → "auto-accept".
+ *   3. everything else → "manual" (untrusted, deny-listed subject, or registry threw —
+ *      PROPOSAL_POLICY_FAIL_SAFE_MANUAL_001; NEVER auto-accept on error).
+ */
+export declare class RegistryBackedProposalPolicy implements ProposalPolicy {
+    private readonly _registry;
+    private readonly _rejectListedSourceIds;
+    private readonly _denyListedSubjectIds;
+    constructor(registry: TrustedDataSourceRegistry, opts?: {
+        readonly rejectListedSourceIds?: Iterable<string>;
+        readonly denyListedSubjectIds?: Iterable<string>;
+    });
+    evaluate(input: ProposalPolicyInput): Promise<ProposalDisposition>;
+    addSourceToRejectList(id: string): this;
+    addSubjectToDenyList(id: string): this;
+}

package/dist/proposal/proposal-policy.js

@@ -0,0 +1,72 @@
+// Platform-02 — ProposalPolicy.
+//
+// PROPOSAL_POLICY_MANUAL_DEFAULT_001: DefaultProposalPolicy and every unknown/uncertain
+//   case → "manual"; identical to pre-Platform-02 behavior.
+// PROPOSAL_POLICY_FAIL_SAFE_MANUAL_001: policy/registry exception during evaluation →
+//   "manual", never "auto-accept".
+// PROPOSAL_POLICY_REJECT_LIST_PRECEDENCE_001: explicit reject-list wins over trust — a
+//   reject-listed source is auto-rejected even if the registry would trust it.
+// PROPOSAL_POLICY_SUBJECT_DENY_LIST_BLOCKS_AUTO_ACCEPT_001: deny-listed subject downgrades
+//   auto-accept to manual (not auto-reject).
+// ─── DefaultProposalPolicy ────────────────────────────────────────────────────────
+/** Always "manual" — matches pre-Platform-02 behavior when no policy is configured. */
+export class DefaultProposalPolicy {
+    async evaluate(_input) {
+        return "manual";
+    }
+}
+// ─── RegistryBackedProposalPolicy ─────────────────────────────────────────────────
+/**
+ * Evaluation order:
+ *   1. sourceId in reject-list → "auto-reject" (PROPOSAL_POLICY_REJECT_LIST_PRECEDENCE_001).
+ *   2. registry.isSourceTrusted(sourceId, scope) === true AND subjectId not deny-listed
+ *      → "auto-accept".
+ *   3. everything else → "manual" (untrusted, deny-listed subject, or registry threw —
+ *      PROPOSAL_POLICY_FAIL_SAFE_MANUAL_001; NEVER auto-accept on error).
+ */
+export class RegistryBackedProposalPolicy {
+    _registry;
+    _rejectListedSourceIds = new Set();
+    _denyListedSubjectIds = new Set();
+    constructor(registry, opts) {
+        this._registry = registry;
+        if (opts?.rejectListedSourceIds !== undefined) {
+            for (const id of opts.rejectListedSourceIds)
+                this._rejectListedSourceIds.add(id);
+        }
+        if (opts?.denyListedSubjectIds !== undefined) {
+            for (const id of opts.denyListedSubjectIds)
+                this._denyListedSubjectIds.add(id);
+        }
+    }
+    async evaluate(input) {
+        // PROPOSAL_POLICY_REJECT_LIST_PRECEDENCE_001: reject-list wins over trust.
+        if (this._rejectListedSourceIds.has(input.sourceId)) {
+            return "auto-reject";
+        }
+        let trusted;
+        try {
+            trusted = await this._registry.isSourceTrusted(input.sourceId, input.scope);
+        }
+        catch {
+            // PROPOSAL_POLICY_FAIL_SAFE_MANUAL_001: registry exception → manual, never auto-accept.
+            return "manual";
+        }
+        if (!trusted)
+            return "manual";
+        // PROPOSAL_POLICY_SUBJECT_DENY_LIST_BLOCKS_AUTO_ACCEPT_001
+        if (this._denyListedSubjectIds.has(input.subjectId)) {
+            return "manual";
+        }
+        return "auto-accept";
+    }
+    addSourceToRejectList(id) {
+        this._rejectListedSourceIds.add(id);
+        return this;
+    }
+    addSubjectToDenyList(id) {
+        this._denyListedSubjectIds.add(id);
+        return this;
+    }
+}
+//# sourceMappingURL=proposal-policy.js.map

package/dist/proposal/proposal-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposal-policy.js","sourceRoot":"","sources":["../../src/proposal/proposal-policy.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,EAAE;AACF,wFAAwF;AACxF,4DAA4D;AAC5D,sFAAsF;AACtF,mCAAmC;AACnC,uFAAuF;AACvF,+EAA+E;AAC/E,2FAA2F;AAC3F,6CAA6C;AAqB7C,qFAAqF;AAErF,uFAAuF;AACvF,MAAM,OAAO,qBAAqB;IAChC,KAAK,CAAC,QAAQ,CAAC,MAA2B;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,qFAAqF;AAErF;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA4B;IACtB,SAAS,CAA4B;IACrC,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE3D,YACE,QAAmC,EACnC,IAGC;QAED,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,IAAI,EAAE,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC9C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,qBAAqB;gBAAE,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,IAAI,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC7C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,oBAAoB;gBAAE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAA0B;QACvC,2EAA2E;QAC3E,IAAI,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,wFAAwF;YACxF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC;QAE9B,2DAA2D;QAC3D,IAAI,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,qBAAqB,CAAC,EAAU;QAC9B,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oBAAoB,CAAC,EAAU;QAC7B,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/proposal/proposal-queue.d.ts

@@ -0,0 +1,13 @@
+import type { ProposalId } from "../types/ids.js";
+import type { AgentConsentContext, AccessContext } from "../types/access-context.js";
+import type { AcceptOptions, Proposal, ProposalDecider, ProposalFilter, ProposalInput } from "../types/proposal.js";
+export interface ProposalQueue {
+    createProposal(ctx: AgentConsentContext, input: ProposalInput): Promise<Proposal>;
+    getProposal(ctx: AccessContext, proposalId: ProposalId): Proposal | undefined;
+    listProposals(ctx: AccessContext, filter?: ProposalFilter): Proposal[];
+    acceptProposal(ctx: ProposalDecider, proposalId: ProposalId, options: AcceptOptions): Promise<Proposal>;
+    rejectProposal(ctx: ProposalDecider, proposalId: ProposalId, reason: string): Promise<Proposal>;
+}
+export interface FactoryCompatibleProposalQueue extends ProposalQueue {
+    readonly factoryCompatible: "durable-proposal-queue";
+}

package/dist/proposal/proposal-queue.js

@@ -0,0 +1,15 @@
+// ProposalQueue interface — Slice-08 / Production-06d-b-a.
+//
+// PROPOSAL_AGENT_CAN_CREATE_001: AgentConsentContext may create proposals — validated via GrantRegistry.
+// PROPOSAL_CREATE_USES_GRANT_REGISTRY_001: GrantRegistry is authoritative; ctx.capabilities is ignored.
+// PROPOSAL_AGENT_CANNOT_ACCEPT_001: AgentConsentContext cannot accept proposals.
+// PROPOSAL_AGENT_CANNOT_REJECT_001: AgentConsentContext cannot reject proposals.
+// PROPOSAL_ACCEPT_OWNER_ONLY_001: acceptProposal is restricted to Owner / System / Test contexts.
+// PROPOSAL_REJECT_OWNER_ONLY_001: rejectProposal is restricted to Owner / System / Test contexts.
+//
+// PROPOSAL_QUEUE_ASYNC_INTEGRATION_DECIDED_001 (Production-06d-b-a): createProposal / rejectProposal /
+// acceptProposal are all async. Encryption is required before every durable write —
+// AesGcmCryptoBoundary.encryptJson() uses WebCrypto; no synchronous path exists.
+// getProposal / listProposals remain sync (in-memory cache / Map reads).
+export {};
+//# sourceMappingURL=proposal-queue.js.map

package/dist/proposal/proposal-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposal-queue.js","sourceRoot":"","sources":["../../src/proposal/proposal-queue.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,yGAAyG;AACzG,wGAAwG;AACxG,iFAAiF;AACjF,iFAAiF;AACjF,kGAAkG;AAClG,kGAAkG;AAClG,EAAE;AACF,uGAAuG;AACvG,oFAAoF;AACpF,iFAAiF;AACjF,yEAAyE"}

package/dist/proposal/source-aware-claim-appender.d.ts

@@ -0,0 +1,13 @@
+import type { ClaimId } from "../types/ids.js";
+import type { AppendClaimInput } from "../types/claim.js";
+import type { AcceptedClaimAppender, AppendDecider } from "./accepted-claim-appender.js";
+import type { SourceRegistry } from "../source/source-registry.js";
+import { SourceAwareFactStore } from "../source/source-aware-fact-store.js";
+import type { UnitOfWork } from "../persistence/unit-of-work.js";
+export declare class SourceAwareClaimAppender implements AcceptedClaimAppender {
+    private readonly _store;
+    private readonly _registry;
+    private readonly _uow;
+    constructor(_store: SourceAwareFactStore, _registry: SourceRegistry, _uow: UnitOfWork);
+    appendAll(ctx: AppendDecider, claims: ReadonlyArray<AppendClaimInput>): Promise<ReadonlyArray<ClaimId>>;
+}